One inbox. One controller.

§ 01 · CONTROLLER AND CONTACT

Smash Daddys Ltd is the data controller.

Smash Daddys Ltd, a company registered in England, operates HOTMESS and is the data controller for all personal information described in our Privacy Policy. Registered office is available on request via the compliance address below.

Founder: Phil Gizzie. Day-to-day responsibility for compliance matters rests with the founder; there is no separate Data Protection Officer (Smash Daddys Ltd is below the UK GDPR threshold for mandatory DPO appointment).

One address for everything compliance-related: compliance@hotmessldn.com. Routed directly to the founder; no auto-responder, no triage queue.

§ 02 · DATA SUBJECT ACCESS REQUESTS

Under UK GDPR Article 15, you have the right to a copy of all personal data we hold about you. To exercise this right:

1. Email compliance@hotmessldn.com with subject "Subject Access Request".
2. Include the email address on your HOTMESS account so we can verify the request belongs to you.
3. We acknowledge within 48 hours and respond fully within 30 calendar days as required by Article 12.
4. Free of charge. We do not refuse requests; we do not charge for manifestly-unfounded requests except in the most extreme cases (we have not done so to date).

The full set of UK GDPR rights — access, rectification, erasure, restriction, portability, objection, consent withdrawal — is documented in the Privacy Policy § 08.

§ 03 · LAW-ENFORCEMENT REQUESTS

UK legal process only. Each request logged.

HOTMESS users are gay. Some HOTMESS users live in jurisdictions where gay presence is criminalised. We will not respond to extra-jurisdictional law-enforcement requests; we respond only to valid UK legal process (a production order, court order, or a statutory demand we are required to honour).

Every law-enforcement request is logged. The log is reviewed by the founder. We do not pre-emptively share data with any agency. We do not participate in voluntary information-sharing schemes that fall outside the controller-processor frameworks of the UK GDPR.

Law-enforcement contact: compliance@hotmessldn.com with subject "Law-Enforcement Request". Process is in our internal docs/founder/legal/le-requests.md doctrine; principles are public, the procedure is internal so it is not gameable.

§ 04 · DATA BREACH POLICY

If a personal-data breach occurs that is likely to result in a risk to the rights and freedoms of users:

• We notify the UK ICO within 72 hours of becoming aware, per UK GDPR Article 33.
• We notify affected users without undue delay if the breach is likely to result in high risk, per Article 34.
• The breach notification states what happened, what data was involved, what we are doing to contain it, and what you can do to protect yourself.
• We do not minimise or delay breach notifications. The 72-hour clock starts the moment we become aware, not the moment we have all the answers.

We have not had a notifiable personal-data breach to date. If we ever do, this page will carry a public notice for a minimum of 12 months.

§ 05 · ACCESSIBILITY

The HOTMESS homepage and platform aim for WCAG 2.2 Level AA conformance. We will not always meet it on every surface immediately — type contrast, motion controls, and screen-reader landmarks are the most likely failure points. If you encounter an accessibility barrier, write to compliance@hotmessldn.com and we will fix it with priority.

Motion is reduced for users with prefers-reduced-motion: reduce in their browser / OS settings — confirmed on the hero rise animation, the marquee, and the Pulse pulsation utilities.

§ 06 · COMPLAINTS

First step: write to compliance@hotmessldn.com. We respond within 30 days, escalate to the founder, and aim to resolve directly. The mutual commitment letter every founding partner signs commits both sides to direct conversation first before formal escalation.

If we cannot resolve a complaint to your satisfaction, you have the right to lodge a complaint with the UK Information Commissioner's Office (data-protection matters), or with the relevant statutory ombudsman for other domains.

§ 07 · STATUTORY DETAILS

§ 08 · QUARTERLY TRANSPARENCY REPORT

Founding partners and Recovery Partners receive a quarterly report listing every vendor that touches their data, what was retained, and what was deleted. The report is sent direct from compliance@hotmessldn.com on the first working day of each quarter.

§ 09 · CONTACT

Compliance / data: compliance@hotmessldn.com
Care / recovery: care@hotmessldn.com
Founder: phil@hotmessldn.com